A type confusion vulnerability exists in PostgreSQL materialized set-returning functions, including json_populate_recordset(), that allows a database user to execute arbitrary code with the privileges of the operating system user running the database. This affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability is classified as high severity with a CVSS score of 8.8.